Fix: Rebooting GitLab may trigger ClamAV alarm (#6114) #6763

dsotirho-ucsc · 2024-12-13T19:26:08Z

Connected issues: #6114

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues connected to this PR}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after approval)

PR is not a draft
Ticket is in Review requested column
PR is awaiting requested review from system administrator
PR is assigned to only the system administrator

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved connected issues to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

coveralls · 2024-12-13T19:49:46Z

coverage: 85.641%. remained the same
when pulling 216317f on issues/dsotirho-ucsc/6114-prune
into 34d7ce4 on develop.

codecov · 2024-12-13T19:54:21Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.62%. Comparing base (34d7ce4) to head (216317f).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #6763   +/-   ##
========================================
  Coverage    85.62%   85.62%           
========================================
  Files          149      149           
  Lines        20945    20945           
========================================
  Hits         17934    17934           
  Misses        3011     3011

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

dsotirho-ucsc · 2024-12-16T18:29:07Z

6763_IT_2024-12-16.txt

nadove-ucsc

First commit title doesn't read well. I suggest "Refactor Docker prune commands"

nadove-ucsc · 2024-12-16T21:46:35Z

terraform/gitlab/gitlab.tf.json.template.py

@@ -1936,20 +1936,20 @@ def merge(sets: Iterable[Iterable[str]]) -> Iterable[str]:
                                    )
                                    for command in [
                                        sq(
+                                            # docker volume prune --force --all


This comment doesn't seem useful.

Ah, that was notes-to-self unintentionally left in.

terraform/gitlab/gitlab.tf.json.template.py

dsotirho-ucsc · 2024-12-16T23:03:37Z

6763_IT_2024-12-16.txt

hannes-ucsc

How was this tested?

dsotirho-ucsc · 2024-12-17T19:00:28Z

How was this tested?

The refactor was tested by diffing the generated gitlab.tf.json before and after the commit.
The modified Docker commands were taken verbatim from the ticket and not tested.

hannes-ucsc · 2024-12-31T02:48:35Z

How was this tested?

The refactor was tested by diffing the generated gitlab.tf.json before and after the commit. The modified Docker commands were taken verbatim from the ticket and not tested.

In other words, it wasn't tested. Looking at diffs does not constitute a test, by this team's standards. It is the PR author's responsibility to test their changes. The fact that a command was given in the issue does not absolve the author of that responsibility.

dsotirho-ucsc · 2025-01-07T02:05:05Z

Test on tempdev of the modified prune-images service:


## Check command lines executed by prune-images service

[ec2-user@ip-172-25-0-222 ~]$ sudo grep ExecStart /etc/systemd/system/prune-images.service
ExecStartPre=-/usr/bin/docker stop prune-images
ExecStartPre=-/usr/bin/docker rm prune-images
ExecStartPre=/usr/bin/docker pull 654654270592.dkr.ecr.us-east-1.amazonaws.com/docker.io/library/docker@sha256:e0733e0529749cec359cacf2d698214338f50dfb795a4673204504016e27d1dc
ExecStart=/usr/bin/docker exec gitlab-dind sh -c 'docker volume prune --force --all > /proc/1/fd/1'
ExecStart=/usr/bin/docker exec gitlab-dind sh -c 'docker system prune --force --all --filter "until=2160h" > /proc/1/fd/1'


## Check Docker volumes, images, & containers before starting service

[ec2-user@ip-172-25-0-222 ~]$ sudo docker volume ls
DRIVER    VOLUME NAME
local     b1548a9d710b9b47b4c62de8a71e5ff2ad76fdd3e17375990be974b33e915240

[ec2-user@ip-172-25-0-222 ~]$ sudo docker system df
TYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLE
Images          3         3         4.714GB   0B (0%)
Containers      3         1         759B      0B (0%)
Local Volumes   1         1         0B        0B
Build Cache     0         0         0B        0B


## Check status of prune-images service before starting service

[ec2-user@ip-172-25-0-222 ~]$ sudo systemctl status prune-images
● prune-images.service - Pruning of stale docker images
   Loaded: loaded (/etc/systemd/system/prune-images.service; static; vendor preset: disabled)
   Active: inactive (dead)


## Start the prune-images service

[ec2-user@ip-172-25-0-222 ~]$ date; sudo systemctl start prune-images
Sat Dec 21 07:56:39 UTC 2024


## Check status of prune-images service after starting

[ec2-user@ip-172-25-0-222 ~]$ sudo systemctl status prune-images
● prune-images.service - Pruning of stale docker images
   Loaded: loaded (/etc/systemd/system/prune-images.service; static; vendor preset: disabled)
   Active: inactive (dead) since Sat 2024-12-21 07:56:39 UTC; 6s ago
  Process: 390 ExecStart=/usr/bin/docker exec gitlab-dind sh -c docker system prune --force --all --filter "until=2160h" > /proc/1/fd/1 (code=exited, status=0/SUCCESS)
  Process: 357 ExecStart=/usr/bin/docker exec gitlab-dind sh -c docker volume prune --force --all > /proc/1/fd/1 (code=exited, status=0/SUCCESS)
  Process: 335 ExecStartPre=/usr/bin/docker pull 654654270592.dkr.ecr.us-east-1.amazonaws.com/docker.io/library/docker@sha256:e0733e0529749cec359cacf2d698214338f50dfb795a4673204504016e27d1dc (code=exited, status=0/SUCCESS)
  Process: 324 ExecStartPre=/usr/bin/docker rm prune-images (code=exited, status=1/FAILURE)
  Process: 300 ExecStartPre=/usr/bin/docker stop prune-images (code=exited, status=1/FAILURE)
 Main PID: 390 (code=exited, status=0/SUCCESS)

Dec 21 07:56:39 ip-172-25-0-222.ec2.internal systemd[1]: Starting Pruning of stale docker images...
Dec 21 07:56:39 ip-172-25-0-222.ec2.internal systemd[1]: Started Pruning of stale docker images.


## Check Docker volumes, images, & containers after service completed

[ec2-user@ip-172-25-0-222 ~]$ sudo docker volume ls
DRIVER    VOLUME NAME
local     97f8eca4b8bd3b68af589c1c1bca43a4f059b7961d2fb09f9f656ef73acc9eb5

[ec2-user@ip-172-25-0-222 ~]$ sudo docker system df
TYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLE
Images          3         3         4.714GB   0B (0%)
Containers      3         3         759B      0B (0%)
Local Volumes   1         1         0B        0B
Build Cache     0         0         0B        0B


## Check for log messages related to prune-images service being run

[ec2-user@ip-172-25-0-222 ~]$ sudo less /var/log/messages

...
Dec 21 07:56:39 ip-172-25-0-222 systemd: Starting Pruning of stale docker images...
Dec 21 07:56:39 ip-172-25-0-222 docker: gitlab-dind: Total reclaimed space: 0B
Dec 21 07:56:39 ip-172-25-0-222 docker: gitlab-dind: Total reclaimed space: 0B
Dec 21 07:56:39 ip-172-25-0-222 systemd: Started Pruning of stale docker images.
...

hannes-ucsc

Please update the unit name and description to reflect the fact that this prunes more than just images. The unit name should be docker-prune

hannes-ucsc · 2025-01-07T05:10:55Z

terraform/gitlab/gitlab.tf.json.template.py

+                                            'system',  # … system command …
+                                            'prune',  # … to delete, …
+                                            '--force',  # … without prompting for confirmation, …
+                                            '--all',  # … all unused images …


This prunes more than just images.

dsotirho-ucsc · 2025-01-07T18:04:16Z

6763_IT_2025-01-07.txt

hannes-ucsc

#6763 (comment)

dsotirho-ucsc · 2025-01-08T00:28:52Z

6763_IT_2025-01-07.txt

github-actions bot added the orange [process] Done by the Azul team label Dec 13, 2024

dsotirho-ucsc requested a review from nadove-ucsc December 16, 2024 18:29

dsotirho-ucsc assigned nadove-ucsc Dec 16, 2024

nadove-ucsc requested changes Dec 16, 2024

View reviewed changes

nadove-ucsc removed their assignment Dec 16, 2024

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6114-prune branch from c29648c to 7f0a6c3 Compare December 16, 2024 22:36

dsotirho-ucsc requested a review from nadove-ucsc December 16, 2024 23:03

dsotirho-ucsc assigned nadove-ucsc Dec 16, 2024

nadove-ucsc previously approved these changes Dec 16, 2024

View reviewed changes

nadove-ucsc marked this pull request as ready for review December 16, 2024 23:31

nadove-ucsc requested a review from hannes-ucsc as a code owner December 16, 2024 23:31

nadove-ucsc assigned hannes-ucsc and unassigned nadove-ucsc Dec 16, 2024

hannes-ucsc reviewed Dec 17, 2024

View reviewed changes

hannes-ucsc removed their assignment Dec 17, 2024

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6114-prune branch from 7f0a6c3 to 8246db1 Compare December 21, 2024 00:09

hannes-ucsc added the 1 review [process] Lead requested changes once label Dec 31, 2024

dsotirho-ucsc requested a review from hannes-ucsc January 7, 2025 02:05

dsotirho-ucsc assigned hannes-ucsc Jan 7, 2025

hannes-ucsc approved these changes Jan 7, 2025

View reviewed changes

hannes-ucsc requested changes Jan 7, 2025

View reviewed changes

hannes-ucsc removed their assignment Jan 7, 2025

dsotirho-ucsc dismissed nadove-ucsc’s stale review via 23a5164 January 7, 2025 17:41

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6114-prune branch from 8246db1 to 23a5164 Compare January 7, 2025 17:41

dsotirho-ucsc requested a review from hannes-ucsc January 7, 2025 18:04

dsotirho-ucsc assigned hannes-ucsc Jan 7, 2025

hannes-ucsc requested changes Jan 7, 2025

View reviewed changes

hannes-ucsc added 2 reviews [process] Lead requested changes twice and removed 1 review [process] Lead requested changes once labels Jan 7, 2025

hannes-ucsc removed their assignment Jan 7, 2025

dsotirho-ucsc added 3 commits January 7, 2025 12:39

Refactor Docker prune commands

a83e882

Modify Docker prune commands (#6114)

668b01e

fixup! Modify Docker prune commands (#6114)

216317f

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6114-prune branch from 23a5164 to 216317f Compare January 7, 2025 21:48

dsotirho-ucsc requested a review from hannes-ucsc January 8, 2025 00:29

dsotirho-ucsc assigned hannes-ucsc Jan 8, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: Rebooting GitLab may trigger ClamAV alarm (#6114) #6763

Fix: Rebooting GitLab may trigger ClamAV alarm (#6114) #6763

dsotirho-ucsc commented Dec 13, 2024 •

edited by hannes-ucsc

Loading

coveralls commented Dec 13, 2024 •

edited

Loading

codecov bot commented Dec 13, 2024 •

edited

Loading

dsotirho-ucsc commented Dec 16, 2024

nadove-ucsc left a comment

nadove-ucsc Dec 16, 2024

dsotirho-ucsc Dec 16, 2024

dsotirho-ucsc commented Dec 16, 2024

hannes-ucsc left a comment

dsotirho-ucsc commented Dec 17, 2024

hannes-ucsc commented Dec 31, 2024

dsotirho-ucsc commented Jan 7, 2025

hannes-ucsc left a comment

hannes-ucsc Jan 7, 2025

dsotirho-ucsc commented Jan 7, 2025

hannes-ucsc left a comment

dsotirho-ucsc commented Jan 8, 2025

Fix: Rebooting GitLab may trigger ClamAV alarm (#6114) #6763

Are you sure you want to change the base?

Fix: Rebooting GitLab may trigger ClamAV alarm (#6114) #6763

Conversation

dsotirho-ucsc commented Dec 13, 2024 • edited by hannes-ucsc Loading

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

coveralls commented Dec 13, 2024 • edited Loading

codecov bot commented Dec 13, 2024 • edited Loading

Codecov Report

dsotirho-ucsc commented Dec 16, 2024

nadove-ucsc left a comment

Choose a reason for hiding this comment

nadove-ucsc Dec 16, 2024

Choose a reason for hiding this comment

dsotirho-ucsc Dec 16, 2024

Choose a reason for hiding this comment

dsotirho-ucsc commented Dec 16, 2024

hannes-ucsc left a comment

Choose a reason for hiding this comment

dsotirho-ucsc commented Dec 17, 2024

hannes-ucsc commented Dec 31, 2024

dsotirho-ucsc commented Jan 7, 2025

hannes-ucsc left a comment

Choose a reason for hiding this comment

hannes-ucsc Jan 7, 2025

Choose a reason for hiding this comment

dsotirho-ucsc commented Jan 7, 2025

hannes-ucsc left a comment

Choose a reason for hiding this comment

dsotirho-ucsc commented Jan 8, 2025

dsotirho-ucsc commented Dec 13, 2024 •

edited by hannes-ucsc

Loading

coveralls commented Dec 13, 2024 •

edited

Loading

codecov bot commented Dec 13, 2024 •

edited

Loading